@dypai-ai/mcp 1.5.12 → 1.5.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.5.12",
+  "version": "1.5.14",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -1121,7 +1121,7 @@ async function handleRequest(msg) {
     return makeResponse(id, {
       protocolVersion: "2024-11-05",
       capabilities: { tools: {} },
-      serverInfo: { name: "dypai", version: "1.5.12" },
+      serverInfo: { name: "dypai", version: "1.5.14" },
       instructions: SERVER_INSTRUCTIONS,
     })
   }

package/src/tools/capability-kits.js

@@ -1,9 +1,14 @@
+import crypto from "crypto"
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, copyFileSync } from "fs"
+import { tmpdir } from "os"
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "path"
 import { fileURLToPath } from "url"
+import { proxyToolCall } from "./proxy.js"
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const DEFAULT_LIMIT = 5
+const DEFAULT_R2_BUCKET = "organizations-storage"
+const DEFAULT_R2_PREFIX = "capability-kits"
 
 function readJson(path) {
   return JSON.parse(readFileSync(path, "utf8"))
@@ -46,10 +51,220 @@ function resolveKitsRoot(inputRoot) {
   if (fromThisFile) return join(fromThisFile, "dypai-capability-kits")
 
   throw new Error(
-    "Capability kit repo not found. Set DYPAI_CAPABILITY_KITS_ROOT to the local dypai-capability-kits directory.",
+    "Capability kit repo not found locally. Set DYPAI_CAPABILITY_KITS_ROOT for local authoring or configure R2 credentials for remote kit install.",
   )
 }
 
+function tryResolveKitsRoot(inputRoot) {
+  try {
+    return resolveKitsRoot(inputRoot)
+  } catch {
+    return null
+  }
+}
+
+function hasLocalKit(root, slug, version) {
+  return Boolean(root) && existsSync(join(root, "kits", slug, version, "kit.json"))
+}
+
+function sha256Buffer(buffer) {
+  return crypto.createHash("sha256").update(buffer).digest("hex")
+}
+
+function safeLogicalPath(path) {
+  if (typeof path !== "string" || !path.trim()) throw new Error("Remote kit file path is invalid")
+  const normalized = path.replace(/\\/g, "/").replace(/^\/+/, "")
+  if (!normalized || normalized.includes("..") || isAbsolute(normalized)) {
+    throw new Error(`Unsafe remote kit file path: ${path}`)
+  }
+  return normalized
+}
+
+function parseR2SourceUri(sourceUri, slug) {
+  if (typeof sourceUri !== "string" || !sourceUri.startsWith("r2://")) return null
+  const withoutScheme = sourceUri.slice("r2://".length)
+  const slash = withoutScheme.indexOf("/")
+  if (slash <= 0) throw new Error(`Invalid capability kit source_uri: ${sourceUri}`)
+  const bucket = withoutScheme.slice(0, slash)
+  const rootKey = withoutScheme.slice(slash + 1).replace(/^\/+|\/+$/g, "")
+  if (!rootKey || !rootKey.split("/").includes(slug)) {
+    throw new Error(`Capability kit source_uri does not look like a kit root for ${slug}: ${sourceUri}`)
+  }
+  return { bucket, rootKey }
+}
+
+function resolveRemoteKitLocation(slug, sourceUri) {
+  const parsed = parseR2SourceUri(sourceUri, slug)
+  if (parsed) return parsed
+  const bucket = process.env.CAPABILITY_KITS_R2_BUCKET
+    || process.env.DYPAI_CAPABILITY_KITS_R2_BUCKET
+    || process.env.CLOUDFLARE_R2_CAPABILITY_KITS_BUCKET
+    || DEFAULT_R2_BUCKET
+  const prefix = (process.env.CAPABILITY_KITS_R2_PREFIX || DEFAULT_R2_PREFIX).replace(/^\/+|\/+$/g, "")
+  return {
+    bucket,
+    rootKey: `${prefix}/${slug}`.replace(/^\/+|\/+$/g, "").replace(/\/+/g, "/"),
+  }
+}
+
+function resolveR2Config(slug, sourceUri) {
+  const endpoint = (process.env.CLOUDFLARE_R2_ENDPOINT_URL || "").replace(/\/$/, "")
+  const accessKeyId = process.env.CLOUDFLARE_R2_ACCESS_KEY_ID || ""
+  const secretAccessKey = process.env.CLOUDFLARE_R2_SECRET_ACCESS_KEY || ""
+  if (!endpoint || !accessKeyId || !secretAccessKey) {
+    throw new Error("Capability kit R2 storage is not configured. Set CLOUDFLARE_R2_ENDPOINT_URL, CLOUDFLARE_R2_ACCESS_KEY_ID, and CLOUDFLARE_R2_SECRET_ACCESS_KEY.")
+  }
+  return { endpoint, accessKeyId, secretAccessKey, ...resolveRemoteKitLocation(slug, sourceUri) }
+}
+
+function hmac(key, value, encoding) {
+  return crypto.createHmac("sha256", key).update(value).digest(encoding)
+}
+
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value).digest("hex")
+}
+
+function encodeRfc3986(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)
+}
+
+function r2Url(config, key) {
+  const encodedKey = key.split("/").map(encodeRfc3986).join("/")
+  return new URL(`${config.endpoint}/${encodeRfc3986(config.bucket)}/${encodedKey}`)
+}
+
+function signingKey(secretAccessKey, dateStamp) {
+  const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp)
+  const dateRegionKey = hmac(dateKey, "auto")
+  const dateRegionServiceKey = hmac(dateRegionKey, "s3")
+  return hmac(dateRegionServiceKey, "aws4_request")
+}
+
+function signedR2Headers(config, method, url, payloadHash) {
+  const now = new Date()
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "")
+  const dateStamp = amzDate.slice(0, 8)
+  const canonicalHeaders = [
+    `host:${url.host}`,
+    `x-amz-content-sha256:${payloadHash}`,
+    `x-amz-date:${amzDate}`,
+    "",
+  ].join("\n")
+  const signedHeaders = "host;x-amz-content-sha256;x-amz-date"
+  const canonicalRequest = [
+    method,
+    url.pathname,
+    url.searchParams.toString(),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join("\n")
+  const credentialScope = `${dateStamp}/auto/s3/aws4_request`
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    sha256Hex(canonicalRequest),
+  ].join("\n")
+  const signature = hmac(signingKey(config.secretAccessKey, dateStamp), stringToSign, "hex")
+
+  return {
+    Authorization: `AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  }
+}
+
+async function r2Get(config, key) {
+  const url = r2Url(config, key)
+  const response = await fetch(url, {
+    method: "GET",
+    headers: signedR2Headers(config, "GET", url, sha256Hex(Buffer.alloc(0))),
+  })
+  if (!response.ok) {
+    throw new Error(`R2 GET failed for ${key}: ${response.status} ${await response.text()}`)
+  }
+  return Buffer.from(await response.arrayBuffer())
+}
+
+function parseRemoteFilesManifest(value, slug, requestedVersion) {
+  const parsed = JSON.parse(value)
+  if (!isObject(parsed)) throw new Error("Remote kit manifest must be a JSON object")
+  if (parsed.slug && parsed.slug !== slug) throw new Error(`Remote kit manifest slug mismatch: expected ${slug}, got ${parsed.slug}`)
+  if (parsed.version && parsed.version !== requestedVersion) {
+    throw new Error(`Remote kit manifest version mismatch: expected ${requestedVersion}, got ${parsed.version}`)
+  }
+  if (!Array.isArray(parsed.files) || !parsed.files.length) {
+    throw new Error(`Remote kit manifest for ${slug} has no files`)
+  }
+  return parsed
+}
+
+function cachedRemoteKitComplete(kitDirPath, manifest) {
+  return (manifest.files || []).every((file) => {
+    try {
+      const rel = safeLogicalPath(file.path)
+      const path = join(kitDirPath, rel)
+      if (!existsSync(path)) return false
+      return file.sha256 ? sha256Buffer(readFileSync(path)) === file.sha256 : true
+    } catch {
+      return false
+    }
+  })
+}
+
+function remoteKitKey(config, logicalPath) {
+  return `${config.rootKey}/${logicalPath}`.replace(/\/+/g, "/").replace(/^\/+/, "")
+}
+
+async function downloadRemoteCapabilityKit(slug, version, sourceUri) {
+  const config = resolveR2Config(slug, sourceUri)
+  const manifestKey = remoteKitKey(config, "manifest.files.json")
+  const manifestText = (await r2Get(config, manifestKey)).toString("utf8")
+  const manifest = parseRemoteFilesManifest(manifestText, slug, version)
+  const contentHash = typeof manifest.contentHash === "string" && manifest.contentHash.trim()
+    ? manifest.contentHash.trim()
+    : sha256Buffer(Buffer.from(manifestText))
+  const cacheRoot = join(tmpdir(), "dypai-capability-kits", slug, contentHash)
+  const kitDirPath = join(cacheRoot, "kits", slug, version)
+  const localManifestPath = join(kitDirPath, "manifest.files.json")
+
+  if (existsSync(localManifestPath) && cachedRemoteKitComplete(kitDirPath, manifest)) {
+    return cacheRoot
+  }
+
+  mkdirSync(kitDirPath, { recursive: true })
+  for (const file of manifest.files || []) {
+    const rel = safeLogicalPath(file.path)
+    const buffer = await r2Get(config, remoteKitKey(config, rel))
+    if (file.sha256 && sha256Buffer(buffer) !== file.sha256) {
+      throw new Error(`Capability kit file hash mismatch for ${slug}/${rel}`)
+    }
+    const target = join(kitDirPath, rel)
+    mkdirSync(dirname(target), { recursive: true })
+    writeFileSync(target, buffer)
+  }
+  writeFileSync(localManifestPath, manifestText)
+  return cacheRoot
+}
+
+async function resolveKitsRootForKit({ kits_root, slug, version, source_uri }) {
+  const sourceMode = (process.env.DYPAI_CAPABILITY_KITS_SOURCE || "").toLowerCase()
+  const localRoot = sourceMode === "remote" ? null : tryResolveKitsRoot(kits_root)
+  if (hasLocalKit(localRoot, slug, version)) return { root: localRoot, source: "local_repo" }
+  const remoteRoot = await downloadRemoteCapabilityKit(slug, version, source_uri)
+  return { root: remoteRoot, source: "r2" }
+}
+
+function shouldSearchRemote(kitsRoot) {
+  const source = (process.env.DYPAI_CAPABILITY_KITS_SOURCE || "").toLowerCase()
+  if (source === "local") return false
+  if (source === "remote") return true
+  if (kitsRoot || process.env.DYPAI_CAPABILITY_KITS_ROOT) return false
+  return Boolean(process.env.DYPAI_TOKEN)
+}
+
 function resolveWorkspaceRoot(inputRoot) {
   if (inputRoot) {
     const root = resolve(inputRoot)
@@ -306,7 +521,7 @@ function writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, nami
     if (overwrite === "fail") throw new Error(`Target already exists: ${targetRel}`)
     if (overwrite !== "replace" || !ownedTargets(record, manifest.slug, manifest.version).has(targetRel)) {
       skipped.push(targetRel)
-      return
+      return false
     }
   }
 
@@ -319,6 +534,7 @@ function writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, nami
     copyFileSync(sourceAbs, targetAbs)
   }
   copied.push(targetRel)
+  return true
 }
 
 export const searchCapabilityKitsTool = {
@@ -330,11 +546,24 @@ export const searchCapabilityKitsTool = {
       query: { type: "string", description: "Feature need and app domain, e.g. booking calendar for hotel reservations." },
       limit: { type: "integer", default: DEFAULT_LIMIT, minimum: 1, maximum: 10 },
       filters: { type: "object", description: "Optional filters: category, maturity, app_type, screen_type, feature_tag, requires." },
-      kits_root: { type: "string", description: "Optional local path to dypai-capability-kits. Defaults to DYPAI_CAPABILITY_KITS_ROOT or sibling repo." },
+      kits_root: { type: "string", description: "Optional local path to dypai-capability-kits. When omitted, the tool may use the remote MCP registry so local behavior matches production." },
     },
     required: ["query"],
   },
   async execute({ query, limit = DEFAULT_LIMIT, filters = {}, kits_root }) {
+    if (shouldSearchRemote(kits_root)) {
+      try {
+        const remote = await proxyToolCall("search_capability_kits", { query, limit, filters })
+        if (isObject(remote)) {
+          return { ...remote, source: remote.source || "mcp_cloud" }
+        }
+        return remote
+      } catch (error) {
+        if (!tryResolveKitsRoot(kits_root)) throw error
+        process.stderr.write(`Capability kit remote search failed, falling back to local repo: ${error.message}\n`)
+      }
+    }
+
     const root = resolveKitsRoot(kits_root)
     const kits = listKits(root)
       .filter(({ manifest }) => matchesFilter(manifest, filters))
@@ -368,13 +597,13 @@ export const searchCapabilityKitsTool = {
   },
 }
 
-function inspectCapabilityKit({ slug, version = "1.0.0", kits_root }) {
-  const root = resolveKitsRoot(kits_root)
+async function inspectCapabilityKit({ slug, version = "1.0.0", kits_root, source_uri }) {
+  const { root, source } = await resolveKitsRootForKit({ kits_root, slug, version, source_uri })
   const { dir, manifest } = loadKit(root, slug, version)
   return {
     ok: true,
     operation: "inspect",
-    source: "local_repo",
+    source,
     kitsRoot: root,
     kit: manifest,
     assets: assetIndex(dir),
@@ -395,13 +624,20 @@ async function applyCapabilityKit({
   overwrite = "skip",
   workspace_root,
   kits_root,
+  source_uri,
 }) {
-  const root = resolveKitsRoot(kits_root)
+  const { root, source } = await resolveKitsRootForKit({ kits_root, slug, version, source_uri })
   const workspaceRoot = resolveWorkspaceRoot(workspace_root)
   const { dir, manifest } = loadKit(root, slug, version)
   const record = readInstallRecord(workspaceRoot)
   const previousEntries = (record.kits || []).filter((item) => item.slug === manifest.slug && item.version === manifest.version)
   const copied = []
+  const copiedByKind = {
+    frontend: [],
+    backend: [],
+    database: [],
+  }
+  const databaseTargetsBySource = new Map()
   const skipped = []
 
   const installFrontend = install.frontend !== false
@@ -416,7 +652,9 @@ async function applyCapabilityKit({
       if (target.frontendDir) {
         targetRel = join(target.frontendDir, stripFrontendPrefix(asset.source)).split(sep).join("/")
       }
-      writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "frontend", overwrite, record, copied, skipped })
+      if (writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "frontend", overwrite, record, copied, skipped })) {
+        copiedByKind.frontend.push(targetRel)
+      }
     }
   }
 
@@ -429,7 +667,9 @@ async function applyCapabilityKit({
       if (target.endpointDir) {
         targetRel = join(target.endpointDir, adaptTarget(asset.source.split("/").pop(), manifest, naming)).split(sep).join("/")
       }
-      writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "backend", overwrite, record, copied, skipped })
+      if (writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "backend", overwrite, record, copied, skipped })) {
+        copiedByKind.backend.push(targetRel)
+      }
     }
   }
 
@@ -443,7 +683,10 @@ async function applyCapabilityKit({
       if (target.databaseDir) {
         targetRel = join(target.databaseDir, source.split("/").pop()).split(sep).join("/")
       }
-      writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "database", overwrite, record, copied, skipped })
+      if (writeTemplateFile({ sourceAbs, targetRel, workspaceRoot, manifest, naming, kind: "database", overwrite, record, copied, skipped })) {
+        copiedByKind.database.push(targetRel)
+        databaseTargetsBySource.set(source, targetRel)
+      }
     }
   }
 
@@ -460,6 +703,14 @@ async function applyCapabilityKit({
   const databaseTables = normalizeList(manifest.databaseManifest?.tables).map((table) =>
     adaptTarget(table, manifest, naming),
   )
+  const schemaSource = installDatabase && isObject(manifest.databaseManifest) && typeof manifest.databaseManifest.schema === "string"
+    ? manifest.databaseManifest.schema
+    : ""
+  const seedSource = installDatabase && isObject(manifest.databaseManifest) && typeof manifest.databaseManifest.seed === "string"
+    ? manifest.databaseManifest.seed
+    : ""
+  const schemaFile = schemaSource ? databaseTargetsBySource.get(schemaSource) : undefined
+  const seedFile = seedSource ? databaseTargetsBySource.get(seedSource) : undefined
 
   const previousFiles = previousEntries.flatMap((item) => Array.isArray(item.files) ? item.files : [])
   const fileMap = new Map()
@@ -488,11 +739,15 @@ async function applyCapabilityKit({
   return {
     ok: true,
     operation: "apply",
+    source,
     slug: manifest.slug,
     version: manifest.version,
     workspaceRoot,
     installed: {
       files: copied,
+      frontendFiles: copiedByKind.frontend,
+      backendFiles: copiedByKind.backend,
+      databaseFiles: copiedByKind.database,
       skipped,
       recordFile: ".dypai/kits/installed.json",
     },
@@ -503,7 +758,12 @@ async function applyCapabilityKit({
     },
     database: {
       tables: databaseTables,
+      sqlFiles: copiedByKind.database,
+      schemaFile,
+      seedFile,
       requiresExecuteSql: Boolean(manifest.install?.requiresExecuteSql || databaseTables.length),
+      applyWith: "execute_sql",
+      schemaRefresh: "automatic_after_successful_ddl",
     },
     dependencies,
     nextSteps: [
@@ -511,7 +771,9 @@ async function applyCapabilityKit({
         ? [`Add any missing package dependencies to the target workspace package.json, then install them locally before building: ${dependencies.join(", ")}.`]
         : []),
       "Wire installed frontend components into the selected app page or route.",
-      ...(databaseTables.length ? ["Apply the installed schema SQL with execute_sql if the tables do not already exist."] : []),
+      ...(databaseTables.length ? [
+        `Before backend tests, ensure tables exist (${databaseTables.join(", ")}): read ${schemaFile || "the installed schema SQL"} and execute its safe CREATE/ALTER statements with execute_sql. Do not edit dypai/schema.sql; it refreshes automatically.`,
+      ] : []),
       ...(backendEndpoints.length ? ["Run backend validation and endpoint tests for installed/renamed endpoints."] : []),
       "Run frontend verification after wiring imports and data callbacks.",
     ],
@@ -527,6 +789,7 @@ export const manageCapabilityKitTool = {
       operation: { type: "string", enum: ["inspect", "apply"], description: "inspect returns manifest/assets. apply copies kit files into the workspace." },
       slug: { type: "string" },
       version: { type: "string", default: "1.0.0" },
+      source_uri: { type: "string", description: "Optional r2://... kit root from search results. Used when the kit is not available locally." },
       targetFeature: { type: "string", description: "Domain/feature being built, e.g. hotel reservations." },
       install: {
         type: "object",
@@ -555,7 +818,7 @@ export const manageCapabilityKitTool = {
       },
       overwrite: { type: "string", enum: ["skip", "fail", "replace"], default: "skip" },
       workspace_root: { type: "string", description: "Optional absolute path to the target app workspace." },
-      kits_root: { type: "string", description: "Optional local path to dypai-capability-kits." },
+      kits_root: { type: "string", description: "Optional local path to dypai-capability-kits. Pass this to force local authoring source; omit it to allow R2 fallback." },
     },
     required: ["operation", "slug"],
   },

package/src/tools/sync/validate.js

@@ -397,6 +397,46 @@ function isWordAt(sql, index, word) {
   return !/[A-Za-z0-9_]/.test(before) && !/[A-Za-z0-9_]/.test(after)
 }
 
+function skipDoubleQuotedIdentifier(sql, index) {
+  if (sql[index] !== "\"") return index
+  for (let i = index + 1; i < sql.length; i++) {
+    if (sql[i] !== "\"") continue
+    if (sql[i + 1] === "\"") {
+      i++
+      continue
+    }
+    return i
+  }
+  return sql.length - 1
+}
+
+function skipSqlSpaces(sql, index) {
+  let i = index
+  while (i < sql.length && /\s/.test(sql[i])) i++
+  return i
+}
+
+function findMatchingParen(sql, openIndex) {
+  if (sql[openIndex] !== "(") return -1
+  let depth = 0
+  for (let i = openIndex; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      depth--
+      if (depth === 0) return i
+    }
+  }
+  return -1
+}
+
 function findOuterSelectList(sqlText) {
   const sql = stripSqlForInference(sqlText)
   if (!sql) return null
@@ -404,6 +444,10 @@ function findOuterSelectList(sqlText) {
   let selectStart = -1
   for (let i = 0; i < sql.length; i++) {
     const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
     if (ch === "(") depth++
     else if (ch === ")") depth = Math.max(0, depth - 1)
 
@@ -417,15 +461,183 @@ function findOuterSelectList(sqlText) {
       return sql.slice(selectStart, i).trim()
     }
   }
+  if (selectStart >= 0) return sql.slice(selectStart).trim()
   return null
 }
 
+function hasTopLevelLimitOne(sqlText) {
+  const sql = stripSqlForInference(sqlText)
+  let depth = 0
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1)
+      continue
+    }
+    if (depth !== 0 || !isWordAt(sql, i, "limit")) continue
+
+    const tail = sql.slice(skipSqlSpaces(sql, i + "limit".length))
+    return /^1(?:\D|$)/.test(tail)
+  }
+  return false
+}
+
+function hasTopLevelFetchOne(sqlText) {
+  const sql = stripSqlForInference(sqlText)
+  let depth = 0
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1)
+      continue
+    }
+    if (depth !== 0 || !isWordAt(sql, i, "fetch")) continue
+
+    let cursor = skipSqlSpaces(sql, i + "fetch".length)
+    if (isWordAt(sql, cursor, "first")) cursor += "first".length
+    else if (isWordAt(sql, cursor, "next")) cursor += "next".length
+    else continue
+    cursor = skipSqlSpaces(sql, cursor)
+    return /^1(?:\D|$)/.test(sql.slice(cursor))
+  }
+  return false
+}
+
+function hasTopLevelGroupBy(sqlText) {
+  const sql = stripSqlForInference(sqlText)
+  let depth = 0
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1)
+      continue
+    }
+    if (depth !== 0 || !isWordAt(sql, i, "group")) continue
+
+    const restStart = i + "group".length
+    const rest = sql.slice(restStart)
+    const byOffset = rest.search(/\S/)
+    if (byOffset >= 0 && isWordAt(sql, restStart + byOffset, "by")) return true
+  }
+  return false
+}
+
+function hasTopLevelSetOperation(sqlText) {
+  const sql = stripSqlForInference(sqlText)
+  let depth = 0
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1)
+      continue
+    }
+    if (depth !== 0) continue
+    if (isWordAt(sql, i, "union") || isWordAt(sql, i, "intersect") || isWordAt(sql, i, "except")) {
+      return true
+    }
+  }
+  return false
+}
+
+const AGGREGATE_FUNCTIONS = ["count", "sum", "avg", "min", "max", "json_agg", "jsonb_agg", "array_agg", "string_agg"]
+
+function isWindowAggregateCall(sql, openIndex) {
+  const closeIndex = findMatchingParen(sql, openIndex)
+  if (closeIndex < 0) return false
+
+  let cursor = skipSqlSpaces(sql, closeIndex + 1)
+  if (isWordAt(sql, cursor, "filter")) {
+    cursor = skipSqlSpaces(sql, cursor + "filter".length)
+    if (sql[cursor] === "(") {
+      const filterClose = findMatchingParen(sql, cursor)
+      if (filterClose >= 0) cursor = skipSqlSpaces(sql, filterClose + 1)
+    }
+  }
+
+  return isWordAt(sql, cursor, "over")
+}
+
+function hasOuterAggregateFunction(selectList) {
+  const sql = String(selectList || "")
+  let depth = 0
+  const activeSubqueryDepths = []
+
+  const insideSubquery = () => activeSubqueryDepths.some(d => d <= depth)
+
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(sql, i)
+      continue
+    }
+    if (ch === "(") {
+      depth++
+      continue
+    }
+    if (ch === ")") {
+      activeSubqueryDepths.splice(0, activeSubqueryDepths.length, ...activeSubqueryDepths.filter(d => d < depth))
+      depth = Math.max(0, depth - 1)
+      continue
+    }
+
+    if (depth > 0 && isWordAt(sql, i, "select")) {
+      activeSubqueryDepths.push(depth)
+      i += "select".length - 1
+      continue
+    }
+
+    for (const fn of AGGREGATE_FUNCTIONS) {
+      if (!isWordAt(sql, i, fn)) continue
+      const openIndex = skipSqlSpaces(sql, i + fn.length)
+      if (sql[openIndex] === "(" && !insideSubquery() && !isWindowAggregateCall(sql, openIndex)) return true
+    }
+  }
+
+  return false
+}
+
 function splitTopLevelComma(list) {
   const parts = []
   let depth = 0
   let start = 0
   for (let i = 0; i < list.length; i++) {
     const ch = list[i]
+    if (ch === "\"") {
+      i = skipDoubleQuotedIdentifier(list, i)
+      continue
+    }
     if (ch === "(") depth++
     else if (ch === ")") depth = Math.max(0, depth - 1)
     else if (ch === "," && depth === 0) {
@@ -478,10 +690,12 @@ function inferSelectOutputColumns(sqlText) {
 function inferSqlCardinality(sqlText) {
   const sql = stripSqlForInference(sqlText)
   if (!sql) return null
-  if (/\blimit\s+1(?:\D|$)/i.test(sql)) return "single"
+  if (hasTopLevelLimitOne(sql) || hasTopLevelFetchOne(sql)) return "single"
   const startsLikeRead = /^(select|with)\b/i.test(sql)
-  const hasAggregate = /\b(count|sum|avg|min|max|json_agg|jsonb_agg|array_agg|string_agg)\s*\(/i.test(sql)
-  const hasGroupBy = /\bgroup\s+by\b/i.test(sql)
+  if (startsLikeRead && hasTopLevelSetOperation(sql)) return "many"
+  const outerSelectList = findOuterSelectList(sql)
+  const hasAggregate = outerSelectList ? hasOuterAggregateFunction(outerSelectList) : false
+  const hasGroupBy = hasTopLevelGroupBy(sql)
   if (startsLikeRead && hasAggregate && !hasGroupBy) return "single"
   return "many"
 }